docs: def generate_aead(hsm, args):
      """ Protect the oath-k in an AEAD. """
      key = get_oath_k(args)
      # Enabled flags 00010000 = YSM_HMAC_SHA1_GENERATE
      flags = struct.pack("< I", 0x10000)
      hsm.load_secret(key + flags)
      nonce = hsm.get_nonce().nonce
      aead = hsm.generate_aead(nonce, args.key_handle)
      if args.debug:
          print "AEAD: %s (%s)" % (aead.data.encode('hex'), aead)
      return nonce, aead